1d7d9b467904098449dca24f471345afbdf2a2655aaaf1b228f9bf9ea9c84845

Resubmissions

20/07/2026, 05:41

260720-gdmhcaav9x6

20/07/2026, 05:34

260720-f9g23afx3l6

Analysis

user interaction
yes
max time kernel
149s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 05:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
OpenSSH-Setup.bat
Size 21KB
Sample260720-gdmhcaav9x
SHA256 1d7d9b467904098449dca24f471345afbdf2a2655aaaf1b228f9bf9ea9c84845
MD5 27d571ea50adddb0260728eeb0522e46
SHA1 44be3cd22fdc8a16ab45ead94bb686ed563d3a36
SHA512 2d079dc3484de123de6610423610ddce571acb7d7d9036b20371fa914c7701db04c1d1b4394d9b6e4e24a9a2dda61830da2999c1d5c3a08111ca3ba58a9fbfe6
SSDEEP 384:uMBkMUhZoZ1xmMROXA+KSONO8vhm4R0nK0kMN8anLRjl7UJ:5U/oZ17Ow+KSONOKhmxcaLR5g
TLSH
T12BA2E615FA06512289B19776EC869018FF5A42BF421B2800B19C91C8AFFC56DC3E8FDF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3196	powershell.exe
1844	powershell.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2964	cmd.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3196	powershell.exe
3196	powershell.exe
1844	powershell.exe
1844	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3196	powershell.exe
Token: SeDebugPrivilege	1844	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2964 wrote to memory of 4864	2964	cmd.exe	90
PID 4864 wrote to memory of 1784	4864	net.exe	91
PID 2964 wrote to memory of 3196	2964	cmd.exe	92
PID 2964 wrote to memory of 1844	2964	cmd.exe	93

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\OpenSSH-Setup.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2964
- C:\Windows\system32\net.exe
  net session
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4864
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:1784
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\OpenSSH-Extract-Bootstrap.ps1" "C:\Users\Admin\AppData\Local\Temp\OpenSSH-Setup.bat" "C:\Users\Admin\AppData\Local\Temp\OpenSSH-Setup-Temp.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3196
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\OpenSSH-Setup-Temp.ps1" -PublicKeyPath "" -TargetUser "Admin" -DiscordWebhookUrl "" -IpCheckIntervalMin 15 -VncPassword "" -OutputDir "C:\Users\Admin\AppData\Local\Temp\"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1844

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 54aa570220e696de49a9a588711123e43032522c4578b6fa4f918d2666c1cb32
MD5 27db61c440595c38f5a7b661c618d0c9
SHA1 87613fdda39013791c068bdeec060f945fa2e908
SHA512 e367d57ce85719fa4e3cfd8083e0a5f71110b3f845c1ea7d3a0a3393066cfa90b96712701f044b731fab41ff6a751b7f4db794795c1f3aec955f642c3df25586
TLSH
T1FC115733F3CC8624C89A413650CEAC1036B587DB519ECE6BBB84D154B43F699DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

OpenSSH-Extract-Bootstrap.ps1

Path C:\Users\Admin\AppData\Local\Temp\OpenSSH-Extract-Bootstrap.ps1
Size 557B
SHA256 c382908be041794f915af7bdc6203a15c7a3e4f7999211b572f24998aed3c84b
MD5 7d3cf7e2c655dde47297727da2535cb3
SHA1 d23a689cd56e41a0b570641e5e5e07707bf7e178
SHA512 5ad0d375fb286592dee75b5a47d93cb0c26b035d61f00fb13f0caf6c30546f44d7455c94f105ca9d0c41ffb93a1991c8f11d48fdcc38c55897a5cd618d5a78de
TLSH
T122F0C036C5558A3F18B52205F079424DF83B410F89A07418A460540BCEF8A1344FEFF7
MD5 SHA1 SHA512 TLSH

Submit Download

OpenSSH-Setup-Temp.ps1

Path C:\Users\Admin\AppData\Local\Temp\OpenSSH-Setup-Temp.ps1
Size 17KB
SHA256 14c7400d80f859c9b82a41fed98cae9f52ab7c8ec877028e93906977a5905ceb
MD5 3ba2b75eff33a12439999d165dd9e57f
SHA1 0f96ee557d70f789819e26ab1a93c46c68cc9858
SHA512 ae1920a086f84918b0259fa7cd443d065a60e66ae657fd22d46470fbab95214938fff0b29c5388cc3c565a3f68076c276864ac079acbed7df217ec4e4634ec24
SSDEEP 384:SZoZ1zmMROXA+KSONO8vhm4R0nK0kMN8anxRjl7UK:KoZ1hOw+KSONOKhmxcaxR5x
TLSH
T1D482B625FA064152C9B1537AFD869018FF5942BF420B280171AC95C8AFFD54DC2A8FAF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1844-22-0x00007FFDE4FE0000-0x00007FFDE5984000-memory.dmp

Download

memory/1844-20-0x00007FFDE4FE0000-0x00007FFDE5984000-memory.dmp

Download

memory/1844-28-0x00007FFDE4FE0000-0x00007FFDE5984000-memory.dmp

Download

memory/1844-29-0x00007FFDE4FE0000-0x00007FFDE5984000-memory.dmp

Download

memory/1844-26-0x00007FFDE4FE0000-0x00007FFDE5984000-memory.dmp

Download

memory/1844-25-0x00007FFDE4FE0000-0x00007FFDE5984000-memory.dmp

Download

memory/1844-24-0x00007FFDE4FE0000-0x00007FFDE5984000-memory.dmp

Download

memory/1844-17-0x00007FFDE4FE0000-0x00007FFDE5984000-memory.dmp

Download

memory/1844-19-0x00007FFDE4FE0000-0x00007FFDE5984000-memory.dmp

Download

memory/1844-21-0x00007FFDE4FE0000-0x00007FFDE5984000-memory.dmp

Download

memory/3196-5-0x00007FFDE4FE0000-0x00007FFDE5984000-memory.dmp

Download

memory/3196-6-0x00007FFDE4FE0000-0x00007FFDE5984000-memory.dmp

Download

memory/3196-1-0x00007FFDE516F000-0x00007FFDE5170000-memory.dmp

Download

memory/3196-4-0x0000015760F60000-0x0000015760F82000-memory.dmp

Download

memory/3196-14-0x00007FFDE4FE0000-0x00007FFDE5984000-memory.dmp

Download

memory/3196-13-0x00007FFDE4FE0000-0x00007FFDE5984000-memory.dmp

Download

memory/3196-10-0x00007FFDE4FE0000-0x00007FFDE5984000-memory.dmp

Download

memory/3196-9-0x00007FFDE4FE0000-0x00007FFDE5984000-memory.dmp

Download

memory/3196-7-0x00007FFDE4FE0000-0x00007FFDE5984000-memory.dmp

Download